Description (CNA)
The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does not ensure that the block to be deleted belong to the plugin, as a result, any authenticated users, such as subscriber can delete arbitrary posts
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Qubely – Advanced Gutenberg Blocks | affected 1.7.8 before 1.7.8 |
CWE
CWE-862
References
ADP enrichment
No English description supplied.